News for hackers. Stuff that matters.
Re:Researchers demo Bluetooth relay attack against Tesla by gernb on Monday May 16, 2022 @08:26PM (#31404626)
I guess if you had a partner, someone could be in the parking lot looking for teslas being parked, then a partner could tail that person and relay over cellular to the first standing near the car?

I'm wondering what the point of this attack is. Any thief who wants in my car will just bust the windows. If they do the relay attack they can steal the car but the car has GPS and can be locked down remotely so it seems like a high risk low reward crime?

Re:Researchers demo Bluetooth relay attack against Tesla by HWR_14 on Monday May 16, 2022 @11:20PM (#31405711)
A thief can use this method in front of cops in broad daylight. Break a window, not so much.
Re:Researchers demo Bluetooth relay attack against Tesla by Gigachad on Tuesday May 17, 2022 @03:00AM (#31406922)
Recent videos would have me believe you can get away with both in broad daylight.
Re:Researchers demo Bluetooth relay attack against Tesla by take_it_not on Tuesday May 17, 2022 @05:47AM (#31408099)
Come to San Francisco and you will witness the art of window breaking.
Re:Researchers demo Bluetooth relay attack against Tesla by noja on Tuesday May 17, 2022 @03:00AM (#31406924)
The thieves would presumably steal it from someone's home and then load it onto a truck and steal the parts.
Re:Researchers demo Bluetooth relay attack against Tesla by makeitdouble on Monday May 16, 2022 @09:56PM (#31405219)
Moving the car to a desert place and stripping it for parts would be a classic move.
Re:Researchers demo Bluetooth relay attack against Tesla by cortesoft on Monday May 16, 2022 @10:34PM (#31405447)
GPS works in the desert.
Re:Researchers demo Bluetooth relay attack against Tesla by gambiting on Tuesday May 17, 2022 @04:42AM (#31407604)
GPS jammers are like $50 from many chinese sellers. That's why GPS/GSM trackers are not accepted by insurance companies as vehicle trackers in my places, you need to have a VHF tracker which is much harder to jam.
Re:Researchers demo Bluetooth relay attack against Tesla by makeitdouble on Monday May 16, 2022 @10:42PM (#31405496)
Sure, and the owner would also be able to get back what's left of their car.
Re:Researchers demo Bluetooth relay attack against Tesla by MBCook on Monday May 16, 2022 @11:18PM (#31405697)
Only within range of cell towers to transmit the info. I’m guessing Teslas don’t have built-in two-way satellite communications.
Re:Researchers demo Bluetooth relay attack against Tesla by HWR_14 on Monday May 16, 2022 @11:22PM (#31405723)
Now we know the real reason for Starlink!
Re:Researchers demo Bluetooth relay attack against Tesla by samwillis on Tuesday May 17, 2022 @01:59AM (#31406523)
But not in a faraday cage. Stick it in a shipping container and close the door…
Re:Researchers demo Bluetooth relay attack against Tesla by oh_sigh on Monday May 16, 2022 @10:39PM (#31405479)
There's probably a single fuse you can pull out, or a single wire you can cut which would disable enough of the system that you could still drive, but it would stop reporting telemetry.
Re:Researchers demo Bluetooth relay attack against Tesla by denysvitali on Tuesday May 17, 2022 @01:53AM (#31406479)
You mean like... the cellular antenna?
Re:Researchers demo Bluetooth relay attack against Tesla by sgtnoodle on Tuesday May 17, 2022 @05:07AM (#31407755)
Cell modems are pretty amazing. One time I wanted to simulate losing reception on one, so I removed the antenna. It still worked, so I added a 50 ohm termination. It still worked. I finally got it to disconnect by putting it all inside an anti-static bag.
Re:Researchers demo Bluetooth relay attack against Tesla by denysvitali on Tuesday May 17, 2022 @06:09AM (#31408267)
Are they? I remember disconneting the antennas of some of my devices for repair purposes and getting no reception at all (not even for emergency calls).

Maybe things changed in the last few years

Re:Researchers demo Bluetooth relay attack against Tesla by sgtnoodle on Tuesday May 17, 2022 @01:08PM (#31413601)
Many radios have more margin on the signal once "connected". I vaguely recall that cell modems in particular need to do an initial registration with the network. That registration is probably at a fairly ancient modulation, without the benefit of the cell tower knowing where the modem is to beam form to it. It seems like that could account for 10's of dB of difference.
Re:Researchers demo Bluetooth relay attack against Tesla by numpad0 on Tuesday May 17, 2022 @08:06AM (#31409257)
There is a waterproof "fuse box" in every car, similar in function to breaker box in a house, on front firewall(even for rear-engined cars!). "Pull a fuse" means removing a fuse for offending subsystem(ECU) to simply disable it, such as ABS, as clean as `apt uninstall sl` would go. What the guy above you is saying is you should be able to turn off "security feature" altogether and the car should revert to an insecure car.

But considering that Teslas are infamous for authenticating every start/stop of individual cars between the key and the infotainment computer and a datacenter in California...

Re:Researchers demo Bluetooth relay attack against Tesla by potatochup on Wednesday May 18, 2022 @10:53AM (#31423542)
I can't tell if your last sentence is sarcastic? But a Tesla doesn't call home to authenticate the kefob. Otherwise you'd never able to start the car outside of cellular reception.
Re:Researchers demo Bluetooth relay attack against Tesla by oh_sigh on Tuesday May 17, 2022 @01:54AM (#31406489)
Of course, but I was just speaking generally, I'm not sure how teslas are laid out and the accessibility of any given component.
Re:Researchers demo Bluetooth relay attack against Tesla by denysvitali on Tuesday May 17, 2022 @02:02AM (#31406541)
Let's say that with enough effort you can probably reach it. But if to do that, you have to disassemble half of the car, then it's possibly not convenient to do so :D

https://www.auto-manual.com/tesla/tesla-model-3/

Re:Researchers demo Bluetooth relay attack against Tesla by TheSpiceIsLife on Tuesday May 17, 2022 @05:46AM (#31408091)
The wiring diagram you've linked and a few well aimed drill bits should do the trick.
Re:Researchers demo Bluetooth relay attack against Tesla by denysvitali on Tuesday May 17, 2022 @06:08AM (#31408259)
Otherwise a big enough faraday cage works too. It's just not that convenient :)
Re:Researchers demo Bluetooth relay attack against Tesla by TheSpiceIsLife on Tuesday May 17, 2022 @06:21AM (#31408348)
I wonder how well this would work. Wouldn't the Faraday cage need to be tuned to the wavelength of the cellular radio?

Someone elsewhere suggested putting the car in a cargo container, but I don't think that works either. I was on a large ferry recently, my phone worked below deck several inclusive distance units away from the coast.

Re:Researchers demo Bluetooth relay attack against Tesla by testbjjl on Monday May 16, 2022 @10:00PM (#31405254)
> seems like a high risk low reward crime?

The upvotes on social media alone will be worth it to many nowadays.

Re:Researchers demo Bluetooth relay attack against Tesla by ffhhj on Monday May 16, 2022 @08:39PM (#31404706)
To leave something in the car without the owner noticing?
Re:Researchers demo Bluetooth relay attack against Tesla by totetsu on Monday May 16, 2022 @09:55PM (#31405202)
Or take something
Re:Researchers demo Bluetooth relay attack against Tesla by paxys on Monday May 16, 2022 @08:41PM (#31404714)
Yeah, this attack works in theory but is so complicated to set up and execute that a random thief is always going to go for one of the easier options, like picking your pocket or smashing a window.

On the other hand if you are a high value target and some person/organization/government has the incentive to target you in this way, you better have adequate protection.

Re:Researchers demo Bluetooth relay attack against Tesla by gambiting on Tuesday May 17, 2022 @04:48AM (#31407643)
>> the incentive to target you in this way, you better have adequate protection.

Having owned some fancy cars, the advice you usally hear from other owners is this - the best protection you can have is a good insurance policy. Putting any kind of lock out/pin/hidden switch system on it, hiding your keys in radio-proof bags etc, is the best recipe to get hurt. Exactly because if you drive such a fancy car, the people coming to steal it are not opportunistic thieves - they are coming to get your car, and they will hurt you to get it. That's why you don't install any extra fancy "trap" systems in the car and you hang your keys right next to the front door, in plain view. If they want to take the car, don't give them a reason to come in and threaten you or your family for the keys or a lock out pin because you thought you were clever with a fancy alarm system. A Lamborghini is replacable. Your life(or the life of your children) is not.

Re:Researchers demo Bluetooth relay attack against Tesla by bin_bash on Tuesday May 17, 2022 @05:55AM (#31408162)
Imagine if we had level 5 self driving and I could from my phone lock the doors on the Lamborghini and drive it straight to the police station
Re:Researchers demo Bluetooth relay attack against Tesla by gambiting on Tuesday May 17, 2022 @06:24AM (#31408369)
Few problems with that:

1) luxury cars that are stolen "on order" are usually placed on a trailer/container straight away and not driven around.

2) you assume you can still talk to the car after it's taken - sadly, GSM/GPS jammers are very cheap and common amongst car thieves.

3) even if you have L5 autonomy, I would be really surprised if you could override what the car is doing while it's being driven. Sounds like a recipe for disaster. I'm not sure anyone should even have the ability to do something as simple as shut it down remotely - there's far too much risk of abuse.

Re:Researchers demo Bluetooth relay attack against Tesla by aequitas on Tuesday May 17, 2022 @05:05AM (#31407743)
https://xkcd.com/538/

I still remember a video from a break in our country where the thieves where pounding the door with an axe for minutes to enter, then threatened the homeowner to open the safe they knew was in the house. His wife and kids where “safe” in the attic. If they know what they want they will get it one way or another.

Re:Researchers demo Bluetooth relay attack against Tesla by w4f7z on Monday May 16, 2022 @11:20PM (#31405710)
>Yeah, this attack works in theory but is so complicated to set up and execute

There are quite a few security camera videos on youtube of people stealing cars parked in driveways by what appears to be a relay attack.

Re:Researchers demo Bluetooth relay attack against Tesla by kramerger on Tuesday May 17, 2022 @02:13AM (#31406620)
Came here to say this.

On those video it looked extremely "easy" to me

Re:Researchers demo Bluetooth relay attack against Tesla by chinathrow on Tuesday May 17, 2022 @02:24AM (#31406682)
> that a random thief is always going to go for one of the easier options, like picking your pocket or smashing a window.

Car thief != pick pocket thief

Re:Researchers demo Bluetooth relay attack against Tesla by Swizec on Monday May 16, 2022 @08:47PM (#31404749)
Like that xkcd about full disk encryption and hammers

https://xkcd.com/538/

Re:Researchers demo Bluetooth relay attack against Tesla by TheSpiceIsLife on Tuesday May 17, 2022 @05:38AM (#31408032)
Has anyone tried to disable the GPS and cellular connection on the models affected?
Re:Researchers demo Bluetooth relay attack against Tesla by zionic on Monday May 16, 2022 @08:40PM (#31404708)
This dawned on me the other day, if someone hopped in my Tesla and drove away I’m not sure I could do anything in the app to hinder them. Maybe set valet mode? Best I could do there is cap it to 50
Re:Researchers demo Bluetooth relay attack against Tesla by paxys on Monday May 16, 2022 @09:04PM (#31404836)
Turns out your car is, in fact, a car.
Re:Researchers demo Bluetooth relay attack against Tesla by zionic on Tuesday May 17, 2022 @03:04PM (#31415052)
The way the app works though with the default setup leaves it unlocked/ready to go until you walk a considerable distance away. I could see thieves eventually figuring that out.
Re:Researchers demo Bluetooth relay attack against Tesla by philips on Monday May 16, 2022 @09:38PM (#31405079)
You can add a PIN as a second factor. See PIN to drive in the manual

https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05...

Re:Researchers demo Bluetooth relay attack against Tesla by Operyl on Monday May 16, 2022 @10:25PM (#31405412)
> If the touchscreen is still unresponsive, you can still bypass PIN to Drive by turning on Keyless Driving in the Tesla mobile app.

Isn't this what the research team is abusing? If so, make sure that's turned off too!

Re:Researchers demo Bluetooth relay attack against Tesla by firloop on Tuesday May 17, 2022 @01:05AM (#31406244)
Pretty sure turning on Keyless driving is separate from unlocking/starting the car with Bluetooth. To do it requires the Tesla account password and I believe is relayed via the LTE connection of the car.
Re:Researchers demo Bluetooth relay attack against Tesla by philips on Monday May 16, 2022 @10:41PM (#31405488)
Huh. I guess you are right… odd
Re:Researchers demo Bluetooth relay attack against Tesla by cortesoft on Monday May 16, 2022 @10:35PM (#31405457)
The cops would be able to follow them via GPS, though.